<!doctype html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<title></title>
	<link rel="stylesheet" type="text/css" href="http://paranoid.net.cn/semantic.css" >
</head>
<body>
<section-title-en>2.7 Segment Registers</section-title-en>
<section-title-ch>2.7 段寄存器</section-title-ch>
<p-en>
	The Intel 64-bit architecture gained widespread adoption thanks to its ability to run software targeting the older 32- bit architecture side-by-side with 64-bit software [169]. This ability comes at the cost of some warts. While most of these warts can be ignored while reasoning about the security of 64-bit software, the segment registers and vestigial segmentation model must be understood.
</p-en>
<p-ch>
	英特尔64位架构获得了广泛的应用，这要归功于它能够将针对旧的32位架构的软件与64位软件并排运行[169]。这种能力是以一些缺点为代价的。虽然在推理64位软件的安全性时，可以忽略这些缺点的大部分，但必须了解段寄存器和残留的段模型。
</p-ch>
<p-en>
	The semantics of the Intel architecture's instructions include the implicit use of a few segments which are loaded into the processor's segment registers shown in Figure 16. Code fetches use the code segment (CS). Instructions that reference the stack implicitly use the stack segment (SS). Memory references implicitly use the data segment (DS) or the destination segment (ES). Via segment override prefixes, instructions can be modified to use the unnamed segments FS and GS for memory references.
</p-en>
<p-ch>
	英特尔架构的指令语义包括隐含使用一些段，这些段被加载到处理器的段寄存器中，如图16所示。代码获取使用代码段（CS）。引用栈的指令隐式使用栈段（SS）。内存引用隐式使用数据段（DS）或目的段（ES）。通过段超越前缀，可以修改指令使用未命名的段FS和GS作为内存引用。
</p-ch>
<p-en>
	Modern operating systems effectively disable segmentation by covering the entire addressable space with one segment, which is loaded in CS, and one data segment, which is loaded in SS, DS and ES. The FS and GS registers store segments covering thread-local storage (TLS).
</p-en>
<p-ch>
	现代操作系统通过用一个段(被加载在CS中)和一个数据段(被加载在SS、DS和ES中)覆盖整个可寻址空间来有效地禁用分段。FS和GS寄存器存储覆盖线程本地存储（TLS）的段。
</p-ch>
<p-en>
	Due to the Intel architecture's 16-bit origins, segment registers are exposed as 16-bit values, called segment selectors. The top 13 bits in a selector are an index in a descriptor table, and the bottom 2 bits are the selector's ring number, which is also called requested privilege level (RPL) in the Intel documentation. Also, modern system software only uses rings 0 and 3 (see §2.3).
</p-en>
<p-ch>
	由于英特尔架构的16位起源，段寄存器被暴露为16位值，称为段选择器。选择器中的前13位是描述符表中的索引，后2位是选择器的环号，环号在Intel文档中也称为请求权限级别（RPL）。另外，现代系统软件只使用环0和3（见§2.3）。
</p-ch>
<p-en>
	Each segment register has a hidden segment descriptor, which consists of a base address, limit, and type information, such as whether the descriptor should be used for executable code or data. Figure 17 shows the effect of loading a 16-bit selector into a segment register. The selector's index is used to read a descriptor from the descriptor table and copy it into the segment register's hidden descriptor.
</p-en>
<p-ch>
	每个段寄存器都有一个隐藏的段描述符，它由基址、限位和类型信息组成，如描述符应用于可执行代码还是数据。图17显示了在段寄存器中加载一个16位选择符的效果。选择符的索引用于从描述符表中读取一个描述符，并将其复制到段寄存器的隐藏描述符中。
</p-ch>
<p-en>
	Figure 17: Loading a segment register. The 16-bit value loaded by software is a selector consisting of an index and a ring number. The index selects a GDT entry, which is loaded into the descriptor part of the segment register.
</p-en>
<p-ch>
	图17：加载一个段寄存器。软件加载的16位值是一个由索引和环号组成的选择器。索引选择一个GDT条目，该条目被加载到段寄存器的描述符部分。
</p-ch>
<p-en>
	In 64-bit mode, all segment limits are ignored. The base addresses in most segment registers (CS, DS, ES, SS) are ignored. The base addresses in FS and GS are used, in order to support thread-local storage. Figure 18 outlines the address computation in this case. The instruction's address, named logical address in the Intel documentation, is added to the base address in the segment register's descriptor, yielding the virtual address, also named linear address. The virtual address is then translated (§2.5) to a physical address.
</p-en>
<p-ch>
	在64位模式下，所有的段限制都被忽略了，大多数段寄存器(CS、DS、ES、SS)中的基本地址被忽略。为了支持线程本地存储，FS和GS中的基地址被使用。图18概述了这种情况下的地址计算。指令的地址，在Intel文档中被命名为逻辑地址，加到段寄存器描述符中的基地址上，得到虚拟地址，也被命名为线性地址。然后将虚拟地址翻译（×2.5）为物理地址。
</p-ch>
<img src="fig.18.jpg" />
<p-en>
	Figure 18: Example address computation process for MOV FS:[RDX], 0. The segment's base address is added to the address in RDX before address translation (§2.5) takes place.
</p-en>
<p-ch>
	图18：MOV FS:[RDX]，0的地址计算过程示例，在地址转换(§2.5)发生之前，段的基地址被加到RDX中的地址。
</p-ch>
<p-en>
	Outside the special case of using FS or GS to reference thread-local storage, the logical and virtual (linear) addresses match. Therefore, most of the time, we can get away with completely ignoring segmentation. In these cases, we use the term “virtual address” to refer to both the virtual and the linear address.
</p-en>
<p-ch>
	除了使用FS或GS来引用线程本地存储的特殊情况外，逻辑地址和虚拟（线性）地址是匹配的。因此，大多数情况下，我们可以完全忽略分段。在这些情况下，我们使用术语 "虚拟地址 "来指代虚拟地址和线性地址。
</p-ch>
<p-en>
	Even though CS is not used for segmentation, 64-bit system software needs to load a valid selector into it. The CPU uses the ring number in the CS selector to track the current privilege level, and uses one of the type bits to know whether it's running 64-bit code, or 32-bit code in compatibility mode.
</p-en>
<p-ch>
	即使CS不用于分段，64位系统软件也需要加载一个有效的选择器进去。CPU使用CS选择器中的环号来跟踪当前的权限级别，并使用类型位中的一个位来知道它运行的是64位代码，还是兼容模式下的32位代码。
</p-ch>
<p-en>
	The DS and ES segment registers are completely ignored, and can have null selectors loaded in them. The CPU loads a null selector in SS when switching privilege levels, discussed in §2.8.2.
</p-en>
<p-ch>
	DS和ES段寄存器完全被忽略，可以在其中加载空选择器。当切换权限级别时，CPU会在SS中加载一个空选择器，在§2.8.2中讨论。
</p-ch>
<p-en>
	Modern kernels only use one descriptor table, the Global Descriptor Table (GDT), whose virtual address is stored in the GDTR register. Table 2 shows a typical GDT layout that can be used by 64-bit kernels to run both 32-bit and 64-bit applications.
</p-en>
<p-ch>
	现代内核只使用一个描述符表，即全局描述符表（GDT），其虚拟地址存储在GDTR寄存器中。表2显示了一个典型的GDT布局，64位内核可以用它来运行32位和64位的应用程序。
</p-ch>
<img src="table.2.jpg" />
<p-en>
	Table 2: A typical GDT layout in the 64-bit Intel Architecture.
</p-en>
<p-ch>
	表2：64位Intel架构中典型的GDT布局。
</p-ch>
<p-en>
	The last entry in Table 2 is a descriptor for the Task State Segment (TSS), which was designed to implement hardware context switching, named task switching in the Intel documentation. The descriptor is stored in the Task Register (TR), which behaves like the other segment registers described above.
</p-en>
<p-ch>
	表2中的最后一条是任务状态段(TSS)的描述符，它是为了实现硬件上下文切换而设计的，在Intel文档中被命名为任务切换。该描述符存储在任务寄存器(TR)中，它的行为与上述其他段寄存器一样。
</p-ch>
<p-en>
	Task switching was removed from the 64-bit architecture, but the TR segment register was preserved, and it points to a repurposed TSS data structure. The 64-bit TSS contains an I/O map, which indicates what parts of the I/O address space can be accessed directly from ring 3, and the Interrupt Stack Table (IST), which is used for privilege level switching (§2.8.2).
</p-en>
<p-ch>
	64位架构中删除了任务切换，但TR段寄存器被保留了下来，它指向一个重新使用的TSS数据结构。64位的TSS包含一个I/O映射，它表明I/O地址空间的哪些部分可以直接从环3访问，以及中断堆栈表(IST)，它用于特权级别的切换(§2.8.2)。
</p-ch>
<p-en>
	Modern operating systems do not allow application software any direct access to the I/O address space, so the kernel sets up a single TSS that is loaded into TR during early initialization, and used to represent all applications running under the OS.
</p-en>
<p-ch>
	现代操作系统不允许应用软件直接访问I/O地址空间，因此内核设置了一个单一的TSS，在早期初始化时加载到TR中，用来代表操作系统下运行的所有应用程序。
</p-ch>


</body>
</html>	